The details are out, and they aren't pretty. A fundamental flaw in DNS first announced on July 8 is even worse than people first thought. The flaw in the domain naming service affects everything from email through to internet phone calls and the SSL certificates that people thought guaranteed security on the web. And according to companies monitoring the internet, attacks are already being carried out.

The domain naming service is what tells your web browser which computer to contact when you type in a web address. A nameserver translates web addresses, such as guardian.co.uk, into the IP address of the computer running the site, so that your machine knows which computer on the internet it should visit to find a site or other information. The bug found by Dan Kaminsky, of security consultant IOActive, makes it possible for attackers to convince a recursive nameserver (which asks other nameservers for information) to visit the wrong IP address.

Kaminsky, who discovered the flaw in March, unveiled the details of the security bug at the Black Hat security conference in Las Vegas earlier this month. And last week, executives at NeuStar UltraDNS, which manages the worldwide registry gateway for Taiwan and China's top level domains outside of those two countries, claimed that the attack has already been used against banks. If true, it means that some unwitting customers typing in their bank's details could be taken to fake sites.

Poison bug

"We are actively seeing cache poisoning attack attempts on a large scale using this bug. We have to imagine that they're still partly successful," says Rodney Joffe of NeuStar. "We monitor some open recursive servers online and we noticed that some have entries that are not the correct entries for banking sites." Some UK banking sites were being targeted, he adds.

"I know our government, defence and banking clients are extremely worried about this, and rightly so," says Steve Lord, founder of security consultancy Mandaloria. "This is one of those attacks that could have a significant effect on British industry and intellectual property."

Kaminsky worked hard to get the large ISPs and other companies to patch their nameservers, but there are reports that even this effort hasn't been entirely successful. Hacker HD Moore quickly updated his hacking toolkit, called Metasploit, with code to exploit the DNS flaw. In the nearest thing that the internet gets to karmic justice, he subsequently found that the nameserver of his ISP had been exploited, and that when he tried to visit Google, his browser took him somewhere else.

Even when ISPs do patch, smaller companies running their own nameservers internally could still be at risk. Small internal nameservers are just as vulnerable as larger ones. While a compromised ISP nameserver could affect thousands of people, compromising an internal nameserver would only affect the computers inside the company that owned it.

"You should not only have your ISPs bring their DNS versions up to date, but you should patch your own DNS servers too, even if it does cause a performance issue," warns Ken Munro of consultant SecureTest.

Microsoft has already issued a patch for its server editions of Windows, while Apple's patch for servers running its software, which came later, didn't solve the problem, according to Andrew Storms of security company nCircle. Apple declined to comment.

"Everything breaks when DNS breaks," Kaminsky told the audience at Black Hat. The bug affects more than mere web browsers. It potentially hits everything - from the auto-update systems that download software upgrades from vendors' websites to phone calls placed over the internet via Voice over Internet Protocol (VoIP) technology.

Kaminsky singled out email as one of the most worrying attack vectors. Computers use DNS to find out where to send email. Email sent from a company via a compromised nameserver could be intercepted and read by a third party. "Email has the highest sensitive information to total lack of encryption ratio of all the technologies that we use," he told the conference.

He said that because of the way most ecommerce sites work, the flaw creates what amounts to a skeleton key for unpatched ecommerce sites. Most of them offer a "forgotten password" function, which enables users to request an email either resetting the password or a reminder. An attacker compromising the site's nameserver would be able to enter an email address in the site's forgotten password field, and then intercept the emails offering to reset that user's password - in effect giving the attacker access to the account. Technology Guardian has already highlighted the dangers of sending password reset information via email.

Ideally, Secure Sockets Layer (SSL) - a technology that uses digital certificates to guarantee a company's identity online - would solve the problem. But SSL is also vulnerable, said Kaminsky. "SSL is occasionally used, and maybe it's used right, but more and more often it's not," he said, and added that 42% of the SSL certificates he checked online were self-signed. If Bob has a certificate saying that he's really Bob, but he signed it himself, how secure is that? Besides, when the certificate authorities that issue SSL certificates verify the owners' information, they often do it via email, which in turn relies on DNS.

But there's a patch for DNS, so people should be safe, right? Not so fast. "There are entire classes of attacks that may still be very, very effective," Kaminsky said, and researchers are already proving him right. Reports are emerging that the patch has been compromised. Russian researchers are said to have been able to poison the latest patched version of BIND - one of the most popular pieces of DNS software, in around 10 hours. However, Lord points out that this would have to be done using machines inside a network, rather than machines on the outside, to make suspicious traffic less noticeable.

A patch in time

What does all this mean for you? First, ask your ISP if it's patched. Second, it might be worth switching to a specialist DNS service provider (you can do this by changing the DNS records associated with your computer's network connection). David Ulevitchof OpenDNS (opendns.com) says that his systems are patched and practically impossible to hack thanks to the way that his nameservers communicate with the rest of the internet.

So what about the long term? After the first, hurried patch, interested parties will be sitting down to flesh out solutions to the problem. But one thing's for sure, said Kaminsky: "Architecturally, we need to stop assuming that the network is as friendly as it is."